The Current Setup
We have a number of machines spread across 13 /24 subnets. Presently we have a fairly dumb router that allows the routing of traffic between these subnets. This is not a firewall and it does not track state.
The Desired Setup
We wish to replace the router with firewalls (a pair of Juniper SRX 345s in a VC). This isn't a particularly easy process as once you start tracking state, you have idle connections timing out.
The applications aren't set up to deal with this and, this, migration to these new firewalls needs to be gradual. We cannot just rip out the routers and assign their IPs to the firewalls.
Take the scenario when machine A (10.20.9.118/24) has been migrated to the new firewalls. Its gateway has been changed to point at the new firewall. Machine B (10.20.12.221/24) has not been migrated - its gateway still points at the old router.
In this scenario, traffic from A to B goes via the new firewall but the return traffic goes via the old router. The new firewall does not see any return traffic and thus drops the state, assuming it is invalid.
Add a static route for machine A, on machine B, via the new firewall. This works fine, except it's a nightmare to maintain as this would need to be done on every machine that communicates with those machines which have been migrated.
Add a static route for machine A on the old router, via the new firewall. This poses a problem because the route will (usually) send the return traffic into the firewall on a different interface than it came out of. As I understand it, Juniper SRX devices track firewall states in zones (which are a set of interfaces) and return traffic will not match a state (and thus will not pass) unless it comes into the same zone. We have 1 zone per subnet.
Presumably people have implemented firewalls into existing networks before. What's the solution here?